Now that's a paper moon :P

I was thinking more on the lines of inserting self-verifying routines into the Ubiboot kernel and userland - after building, portions of the binary are hashed and the hashes stored statically in the kernel (/proc/config.gz or early_param style?)

The entire mmcblk0 could be encrypted with dm-crypt, storing a signed ramdisk (the new /sbin/preinit) that asks for password with sillykbd - a 4-8 digit code can be salted and used as a key

The OMAP AES hardware should help with the speed impact this would entail. It also wouldn't provide device lock security, but a userland daemon with kernel helper could ask for a password every, 24h (user-configurable) or so, and shut down the device if the proper key isn't entered.

This would have the benefit of remaining mostly-transparent to Harmattan, actually even Nemo and other OSes.